Windows 10 updates behind a proxy

[Sheridan]

Does anyone else find Windows 10 updates are really unreliable behind a proxy?

 

We use WSUS, but occasionally want to run a full online update, this is almost impossible to get working. It just stops, drops out with an error or sits 'Downloading'. We have the full MS update sites list whitelisted for unauthenticated access and it makes no difference.

 

I've spend ages trying to add a 6MB language pack to one device and its progress bar never moves, and the proxy shows no activity from that device. It will eventually drop out with the error 0x800F081F.

[Julian]

Windows 10 has 2 proxies, one for IE/Edge set via GUI, and one for Windows system, set via command line.

To set the Windows system proxy

 

1. Set proxy for IE/Edge.

2. search for "cmd.exe", right click and select "Run as Administrator", to get a elevated command prompt.

3. netsh

4. winhhtp

5. import proxy ie

 

You should now get listing showing that the system has imported your proxy settings.

 

This gave me problems first time I came across this issue, This also applies to Windows 7 and 8.

[Sheridan]

It does seem to hit the proxy - but only occasionally. The language pack seems to ignore it but 'normal' updates can be seen hitting the proxy but just dropping out.

 

Setting the proxy in two places is a step backwards though!

[beany1]

Do you have WSUS / Other setup? If so I'm pretty sure that's the issue... Optional features like that will try use WSUS and if you don't have optional features downloaded on WSUS it'll just fail. That's my understanding.

 

https://social.technet.microsoft.com/Forums/en-US/23090805-2035-4439-8f11-2a6e84e53c0c/add-optional-features-when-domain-joined?forum=win10itprosetup

[Arthur]

Windows 10 has 2 proxies, one for IE/Edge set via GUI, and one for Windows system, set via command line.

Btw, steps 4 and 5 aren't required if you combine the 'netsh' commands into a single line.

 

1. Set proxy for IE/Edge.
   
2. search for "cmd.exe", right click and select "Run as Administrator", to get a elevated command prompt.
   
3. netsh winhhtp import proxy ie
   

[Sheridan]

We do use WSUS, but weirdly the issue with the language pack is on a machine that doesn't have the WSUS policy applied to it!

[Sheridan]

Still cannot get this to work. I can see the machine hitting the proxy and then it bombards the firewall (i.e default gateway) for a load of MS sites.

 

So as far as I can tell WU on Windows 10 uses the proxy first then ignores it for subsequent downloads?

[AJWhite1970]

I've used the following command line for Windows 7, 10 and 2012 windows updates and it always works. I use an unauthenticated proxy as I find it fails with 407 errors if I ever try and run through my authenticated proxy

 

netsh winhttp set proxy proxy-server="proxyserver:8080" bypass-list="*.mydomain.local"

 

Andrew

[Sheridan]

I've used the following command line for Windows 7, 10 and 2012 windows updates and it always works. I use an unauthenticated proxy as I find it fails with 407 errors if I ever try and run through my authenticated proxy

 

netsh winhttp set proxy proxy-server="proxyserver:8080" bypass-list="*.mydomain.local"

 

Andrew

 

Hmm, we've tried that exact method. Our proxy is set to unauthenticated for all update sites and it still seems to hit the firewall after an initial connection to the proxy!

[Arthur]

Our proxy is set to unauthenticated for all update sites and it still seems to hit the firewall after an initial connection to the proxy!

Does your update sites list include the following?

 

http://download.windowsupdate.com
http://*.download.windowsupdate.com
http://download.microsoft.com
https://*.update.microsoft.com
http://*.update.microsoft.com
https://update.microsoft.com
http://update.microsoft.com
http://*.windowsupdate.com
http://*.windowsupdate.microsoft.com
http://windowsupdate.microsoft.com
https://*.windowsupdate.microsoft.com
http://ntservicepack.microsoft.com
http://wustat.windows.com

 

Source: https://support.microsoft.com/en-us/kb/885819

[Sheridan]

Does your update sites list include the following?

 

http://download.windowsupdate.com
http://*.download.windowsupdate.com
http://download.microsoft.com
https://*.update.microsoft.com
http://*.update.microsoft.com
https://update.microsoft.com
http://update.microsoft.com
http://*.windowsupdate.com
http://*.windowsupdate.microsoft.com
http://windowsupdate.microsoft.com
https://*.windowsupdate.microsoft.com
http://ntservicepack.microsoft.com
http://wustat.windows.com

 

Source: https://support.microsoft.com/en-us/kb/885819

 

Yes - thats exactly where I got the list from! Its not a case of anything being blocked by the proxy, more like its not trying to use the proxy, and our firewall is blocking (correctly!) this http/https access going directly out.

[AJWhite1970]

Have you got anything strange in here?

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

[Sheridan]

Have you got anything strange in here?

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

 

Nothing there. I think it might be because we're testing with a copy of LTSB downloaded from VLSC - so its the old 'broken' version of Windows from July 2015, whereas the the Edu/Pro versions are the Nov 2015 versions. I think we'll have to try Edu or Pro and see what happens. We can't update LTSB as its just not working behind a proxy.

[SHimmer45]

using ent ltsb (build 10240) for testing here and it updates through a proxy ok once winhttp proxy has been set, also add the setting under the network and internet settings as well.

[AJWhite1970]

Yup, 10240 here as well.

 

I take it "netsh winhttp show proxy" returns the correct settings?

[SHimmer45]

netsh winhttp show proxy needs to show your correct proxy if it says direct connection your going to run into problems

 

netsh winhttp set proxy "proxyaddress":"port" as above does the trick

[ColinP]

Still cannot get this to work. I can see the machine hitting the proxy and then it bombards the firewall (i.e default gateway) for a load of MS sites.

 

So as far as I can tell WU on Windows 10 uses the proxy first then ignores it for subsequent downloads?

 

surly if its got to your firewall and requesting the update URL's it has past the proxy stage? Pc>Proxy>firewall>internet ?

[Sheridan]

"netsh winhttp show proxy" shows the correct settings - its supposed to hit the proxy which will allow update through unauthenticated.

 

It hits the proxy, and then the firewall as the firewall is effectively the default gateway. Therefore its acting like a home pc in the sense it ignores the proxy settings.